15 verification code (OTP) SMS templates

A good verification code message says who sent it, what the code is for, how long it lasts and that it must not be shared. Here are 15 templates ready to adapt, and the rules that make them secure.

The 5 rules of a good OTP message

1. Brand first: the customer should know who is writing before reading the code.
2. What it is for: “to log in”, “to authorize your payment”. If the customer did not request that action, they will know something is wrong.
3. Short validity: NIST’s digital identity guidelines (SP 800-63B) say out-of-band authentication must be completed within 10 minutes.
4. Anti-fraud warning: “Do not share it with anyone. We will never call you to ask for it.”
5. No links: a code does not need a link, and a link in an OTP looks like a phishing attempt.

Keep templates within the GSM7 alphabet (no emojis or unsupported accented characters) so each segment holds 160 characters instead of 70. Replace BRAND with your company name.

Sign-up and number verification

1. BRAND: Your verification code is 482913. It expires in 10 minutes. Do not share it with anyone.
2. BRAND: Use 482913 to confirm your mobile number. If you did not sign up, ignore this message.
3. Welcome to BRAND. Your code to activate your account is 482913. Valid for 10 minutes.

Login

1. BRAND: 482913 is your login code. We will never call you to ask for it.
2. BRAND: We detected a login from a new device. If it was you, use code 482913. If not, change your password.
3. BRAND: Your access code is 482913. It expires in 5 minutes.

Payments and transactions

1. BRAND: To authorize your $1,250.00 payment use code 482913. If you did not make this purchase, do not share it.
2. BRAND: Code 482913 to authorize the transfer to the account ending in 4410. Do not share it with anyone.
3. BRAND: To confirm your ATM withdrawal use 482913. Valid for 3 minutes.

Including the amount or destination helps the customer spot fraud: if someone asks them to read out the code for “something else”, the message gives it away.

Account changes and recovery

1. BRAND: Your code to change your password is 482913. If you did not request it, ignore this message.
2. BRAND: Code 482913 to update your email address. Never share it.
3. BRAND: To register a new device use 482913. If it was not you, call the number on the back of your card.

Templates for code autofill

Android and browsers can read the code and fill in the field for the customer if the message follows certain formats.

1. BRAND: Your code is 482913. Do not share it.

FA+9qCX9VSu — For Android’s SMS Retriever API: the message must be no longer than 140 bytes and include your app’s 11-character hash (the one in this example is fictitious).
2. 482913 is your BRAND code.

@brand.com #482913 — Origin-bound code format: the last line has @ with your domain and # with the code, so the browser only offers it on your site.
3. BRAND: 482913 is your code. Expires in 10 min. — Short version, useful as a flash SMS so the code pops up on screen without being stored.

Mistakes to avoid

• Placing the code at the end of a long text: the customer has to hunt for it and gets it wrong.
• Reusing the same code or using fewer than 6 digits.
• Adding emojis or special characters: the message splits into more segments and costs more.
• Sending from a different sender every time: the customer becomes suspicious.
• Mixing the code with advertising.

Sources

• NIST, SP 800-63B-4 “Digital Identity Guidelines: Authentication and Authenticator Management”, section 3.1.3. pages.nist.gov
• Google for Developers, “Verify phone numbers on the server” (SMS Retriever API). developers.google.com
• W3C WICG, “Origin-bound one-time codes delivered via SMS”. wicg.github.io

Frequently asked questions